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1. Mason Hayes & Curran LLP welcomes the publication of the 14 Fundamentals for a Child- 
Oriented Approach to Data Processing (the Fundamentals) by the Data Protection 
Commission (DPC) in December 2020. 


2. We make this submission in our capacity as Ireland’s leading provider of legal services to 
the Education Sector to include primary, post primary and tertiary level. We have consulted 
with a number of leadership organisations to include the Irish Primary Principal’s Network 
(IPPN) and the National Association of Principals and Deputies (NAPD). 


3: We understand the object of the fundamentals is to drive improvements in standards of 
data processing. The introduction of child-specific data protection interpretative principles 
and recommended measures that will enhance the level of protection afforded to children 
against the data processing risks posed to them by their use of/ access to services in both 
an online and offline world is timely. 


4. Children are very much front and centre of the data protection landscape in Europe, with 
Recital 38 of the GDPR stating that children merit specific protection when it comes to the 
processing of their personal data because they may be less aware of the risks, 
consequences and safeguards involved as well as their data protection rights. Where 
children are aware of the risks associated with the processing of their personal data, their 
age, maturity and developmental capacity will impact on their ability to be able to mitigate 
those risks. 


5, In tandem, the Fundamentals will assist organisations that process children’s data, by 
clarifying the principles, arising from the high-level obligations under the GDPR, to which 
the DPC expects such organisations to adhere. The DPC argue that both online and offline 
(where applicable), the Fundamentals should be complied with by all organisations 
processing children’s data. This includes services that are directed at or is intended for, or 
are likely to be accessed by children. 


6. In Ireland, for data protection purposes, a child is somebody under the age 18, in keeping 
with the definition of a child under the UN Convention on the Rights of the Child (UNCRC) 
as “a person under the age of 18 years.” The Data Protection Act 2018 provides for a digital 
age of consent at 16 for the purposes of Article 8(1) of the GDPR. Essentially this means 
that the processing of data of children under the age of 16, in respect of online services, 
Shall not be lawful without parental consent. 


T. The DPC considers that organisations should comply with the standards and expectations 
which are established in these Fundamentals when the services provided by the 
organisation are directed at, intended for or likely to be accessed by children. Section 1.3 of 
the consultation document states that “Offline, this applies to educational providers” clearly 
indicating that schools at all levels are subject to the Fundamentals. 


10. 


11. 


Fundamentals, 5, and 6 will in particular impact on schools. 
Fundamental (5) Information in every instance. 


“Children are entitled to receive information about the processing of their own personal data 
irrespective of the legal basis relied on and even if consent was given by a parent on their 
behalf to the processing of their personal data”. (Section 3 “Transparency and 
Children”).This it is respectfully submitted aspirational for a large cohort of students. We 
feel it is not feasible in primary schools due to the ages and maturity of the children. 
Consent should still continue to be sought and obtained from parents/guardians. In relation 
to post primary students, we should be mindful that the age of digital consent is 16 years. 
We do however believe that based on the maturity of some children less than 16 years, that 
school principals should seek consent on a case by case basis if the principal considers it 
appropriate. The default position otherwise should still continue to be sought that consent is 
sought and obtained from parents/guardians. 


Fundamental (6) Child-Oriented Transparency 


Privacy information about how personal data is used must be provided in a concise, 
transparent, intelligible and accessible way, using clear and plain language that is 
comprehensible and suited to the age of the child (Section 3 “Transparency and 
Children”). This Fundamental is desirable at post primary level but only appropriate at the 
higher primary levels. 


Recommendations 
(a) More guidance on the issue of consent for students would be welcome. 


(b) The appointment of Data Protection Officers to support all schools should be 
recommended. Currently, Data Protection Officers are only available to support 
schools in the Education and Training Board schools and special schools. An 
example of the challenges facing schools is in relation to a Data Protection Impact 
Assessment (“DPIA”).The support of Data Protection Officers to support schools 
would be invaluable. 


Article 35 GDPR states that a Data Protection Impact Assessment (“DPIA”) must be 
conducted by a controller where a type of data processing, in particular using new 
technologies, is likely to result in a high risk to the rights and freedoms of 
individuals. The GDPR also sets out a number of specific instances in which 
controllers must conduct a DPIA. A DPIA describes a process designed to identify 
risks arising out of the processing of personal data and to minimise these risks as 
far and as early as possible. If required, a DPIA must be completed prior to the 
commencement of the relevant data processing. DPIAs are important tools for 
negating risk, and for demonstrating compliance with the GDPR. 


(c) Data Retention Schedules for personal data belonging to students should be the 
subject of guidance. 


(d) The immediate appointment of a Digital Safety Commissioner should be 
recommended. 
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